Description
SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SQLite | SQLite | < 3.54.0 | 3.54.0 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | sqlite3 | 3.54.1-1 | — |
| Debian 13 | sqlite3 | No fix yet | — |
| Debian 12 | sqlite3 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | sqlite3 | No fix yet | — |
| Ubuntu 26.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 24.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu 22.04 LTS | sqlite +1 | No fix yet | — |
| Ubuntu 20.04 LTS | sqlite | No fix yet | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | sqlite | No fix yet | — |
| Ubuntu 16.04 LTS | sqlite | No fix yet | — |
| Ubuntu 14.04 LTS | sqlite | No fix yet | — |
| Ubuntu Pro 20.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 18.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 16.04 LTS | sqlite3 | No fix yet | — |
| Ubuntu Pro 14.04 LTS | sqlite3 | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | sqlite3 | 3.54.1-2.1 | openSUSE-SU-2026:12493-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | lemon +7 | 3.40.0-1.amzn2023.0.9 | ALAS2023-2026-3452 |
| Amazon Linux 2023 | nodejs22 +4 | 1:22.23.5-1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs22-npm | 1:10.9.9-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | nodejs24 +4 | 1:24.22.3-1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | nodejs24-npm | 1:11.19.1-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2023 | v8-12.4-devel | 3:12.4.254.21-1.22.23.5.1.amzn2023.0.1 | ALAS2023-2026-3456 |
| Amazon Linux 2023 | v8-13.6-devel | 3:13.6.233.17-1.24.22.3.1.amzn2023.0.1 | ALAS2023-2026-3457 |
| Amazon Linux 2 | lemon +4 | 3.7.17-8.amzn2.1.4 | ALAS2-2026-4111 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | sqlite | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | libsqlite3-sys | >= 0.6.0, < 0.39.0 | 0.39.0 | RUSTSEC-2026-0459 |
| crates.io | sqlcipher-src | >= 419.0.3, < 420.0.0 | 420.0.0 | RUSTSEC-2026-0502 |
Advisories 6
- WID-SEC-2026-4260 SQLite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2026
- ALAS2023-2026-3452 Moderate: sqlite security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3456 Important: nodejs22 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2023-2026-3457 Important: nodejs24 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- ALAS2-2026-4111 Moderate: sqlite security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Nov 12, 2026
- openSUSE-SU-2026:12493-1 lemon-3.54.1-2.1 on GA media SUSE / openSUSE Security Updates · Nov 9, 2026
References
- https://sqlite.org/bugs/info/2026-08-17T15:54:41Z issue-tracking
- https://sqlite.org/src/info/f9b4ee369557c36c patch
- https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e patch
- https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672 technical-description
- https://sqlite.org/releaselog/3_54_0.html release-notes
- https://abraxaslabs.tech/research/sqlite-wal-pagesize third-party-advisory
- https://github.com/sqlite/sqlite product
- VulnCheck Advisory: SQLite before 3.54.0 Information Disclosure via WAL Page Size Mismatch third-party-advisory